Raw firewall tools for MikroTik MCP: 16 tools that drop traffic before connection tracking

The MCP server could manage MikroTik filter rules, but it had no way to touch the raw tables. Raw rules run first, in the prerouting and output chains. They are the cheap place to drop blocklisted or rate limited sources, and to exempt traffic from tracking with notrack. Everything else still goes through connection tracking and the filter rules afterwards. This pull request adds sixteen tools for the raw tables, eight for IPv4 and eight for IPv6.

The logic lives in one shared module. The IPv4 and IPv6 tool modules are thin wrappers that pass in their own executor, so the usual test patching still works. The only matcher that differs is time to live for IPv4 and hop limit for IPv6. In read-only mode just the four list and get tools are registered. Creating rules supports the raw specific actions, and it refuses a jump without a target or an address list action without a list. There is no connection state matcher, because raw runs before connection tracking.

RouterOS prints nothing when a write works and prints text when it refuses, often without the word error in it. So create wraps the add in a put and only reports success when a new star id comes back. Set and remove treat any output as a refusal, such as not enough permissions, and remove then counts the rule to confirm it is gone. Every value is model controlled, so names go through quoting and bare matcher values must match a strict pattern. A value with a semicolon and a second command is refused before anything is sent.

The new unit tests run for both address families and cover the exact command strings, the refusal paths and the not found cases. The author also ran the list and get tools against a RouterOS 7.24.2 router. The write tools were not run on a device, because that account was read-only, so a reviewer with a lab router could try create, move and remove. Merging counts as a feature, which raises the minor version and publishes a release.